Gafgyt

Gafgyt, also known as Bashlite, is a type of malware that targets Linux architecture operating systems with the primary intent to launch distributed denial of service (DDoS) attacks. This malicious software infiltrates systems often through suspicious downloads, emails, or websites, and upon entry, it can disrupt operations, steal personal information, or hold data for ransom. Gafgyt and similar botnets like Mirai predominantly dominate the IoT threat landscape, typically scanning IP addresses and domain names. They generate random IP addresses as scanning destinations and establish connections with command-and-control servers, awaiting instructions to launch coordinated attacks on targeted victims. In August 2023, a variant of the Gafgyt botnet actively attempted to exploit a vulnerability tracked as CVE-2017-18368, impacting the end-of-life Zyxel P660HN-T1A router. This variant of Gafgyt uses the vulnerability to expand DDoS attacks on Linux-based systems. By downloading and executing malicious scripts, it establishes connections with command-and-control servers, readying itself to launch coordinated assaults. Another Gafgyt variant, designed to create denial of service (DoS) in Linux architectures, has been observed attacking the TP-Link flaw by downloading and executing a script file, retrieving Linux architecture execution files with the prefix filename "rebirth," and then compiling compromised target IP and architecture information into its initial connection message. However, unpatched devices remain at risk as threat actors continue to dispatch various botnets, including Moobot, Miori, AGoent, Gafgyt variants, and infamous Mirai botnet variants, which can compromise the devices for further nefarious activity such as DDoS attacks. Researchers from Fortiguard Labs Threat Research and ThreatLabz have noted multiple attacks focusing on this vulnerability, with the notorious Mirai and Gafgyt malware families driving the majority of these attacks. These botnets are known for turning devices into zombie-like members of their network, used to perform coordinated attacks on a large scale.